Compliance issue for [SFI-ES5.1] Azure Artifacts - Central Feed Services (CFS)

Hi Team,

I integrated this tool into our repo build pipeline, but encountered a compliance issue [SFI-ES5.1] related to Azure Artifacts - Central Feed Services (CFS). The requirement is that builds must pull open-source libraries from an [Azure Artifacts] feed. To resolve this, I tried using configuration options similar to those provided by other Azure DevOps tasks, providing the params like feedsToUse and nugetConfigPath, such as:

- task: MicrosoftSecurityDevOps@1
  displayName: 'Run Template Analyzer'
  inputs:    
    tools: 'templateanalyzer'
    break: false
    feedsToUse: config
    nugetConfigPath: 'nuget.config'

However, this didn't work as expected. The logs show that MSDO is still retrieving the feed from the public source:

Installing Microsoft.Security.DevOps.Tools.Configuration from feed...
  ------------------------------------------------------------------------------
      GET https://msdous.pkgs.visualstudio.com/d1ee6cdc-c4ce-4e34-95df-4c038f0d3683/_packaging/7c44b921-ee7b-48f1-bad3-d9227399a9fc/nuget/v3/registrations2-semver2/microsoft.security.devops.tools.configuration/index.json
      OK https://msdous.pkgs.visualstudio.com/d1ee6cdc-c4ce-4e34-95df-4c038f0d3683/_packaging/7c44b921-ee7b-48f1-bad3-d9227399a9fc/nuget/v3/registrations2-semver2/microsoft.security.devops.tools.configuration/index.json 84ms

Should we consider supporting a feed suppression feature to help meet security compliance requirements?

Thanks,
Best regards,

Beginne beim Einstiegspunkt der Aufgabe MicrosoftSecurityDevOps@1 und verfolge, wie das Tool templateanalyzer Microsoft.Security.DevOps.Tools.Configuration installiert. Untersuche, wie feedsToUse, nugetConfigPath und nuget.config behandelt werden, und vergleiche anschließend die Paketquelle mit dem protokollierten öffentlichen Feed. Als erledigt gilt die Aufgabe, wenn der Paketabruf den konfigurierten Azure Artifacts-Feed verwenden und die öffentliche Quelle unterdrücken kann.